Chain agreements: feedback, correction, chunking, transport, releases

Transport and security: REST, x-api-key, OAuth 2.0, mTLS and x-jws-signature

VB-PUO uses RESTful APIs over HTTPS only, in a push model: the sender takes the initiative. Authentication is via an API key in the x-api-key header or OAuth 2.0 client credentials; mutual TLS (mTLS) is the principle and messages can be digitally signed with the x-jws-signature header.

Steps

Set-upBoth partiesExchange endpoints, API keys or OAuth clients and certificates; fix the OAS version (1.0.11 for Release 2027).
SendingSenderPOST of the JSON message with x-api-key (or bearer token) and optionally x-jws-signature.
ReceivingReceiverVerify signature, validate against the schema of the stated afdDefinitionVersion and respond according to the six feedback patterns.feedback

Rules and consistency checks

Other transport forms (files, e-mail) are not supported by the standard.
GitHub issues #102 and #143 concern mTLS set-up; #106 API versioning.

Source: Handleiding paragraaf 2.7 en 7.4